comrat | b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8

General

Target
b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
Size 2.1MB
Sample220415-gl8esaggal
SHA256 b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
MD5 ce4a1572a1c6c4aa5e5731d44f3a1db0
SHA1 8cf9e66744745fad5928ed8406db339e01a75de6
SHA512 1b98807d18ff14b537f34d0697eecb3e88b4f18f2a5f65169cae5c4d7aa1f8b8028f4c5935eec757e702863b7189d27c13b4886d2b41a5288821e316bfe68b88
SSDEEP 49152:VTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJHlJo:1RCBNTBwAHlJo
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

comrat

Malware Config

Signatures

ComRAT v4 (Orchestrator DLL) 1 IoCs

File contains strings specific to ComRAT v4 samples first seen in 2017.

resource	yara_rule
sample	ComRAT

Comrat family
comrat

File Explorer

b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8

.dll 2.1MB

b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8

IMPHASH d9d661a606c9d1c23b47672d1067de68
SHA256 b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8
MD5 ce4a1572a1c6c4aa5e5731d44f3a1db0
SHA1 8cf9e66744745fad5928ed8406db339e01a75de6
SHA512 1b98807d18ff14b537f34d0697eecb3e88b4f18f2a5f65169cae5c4d7aa1f8b8028f4c5935eec757e702863b7189d27c13b4886d2b41a5288821e316bfe68b88
SSDEEP 49152:VTRjrgdOU9p1PZH/JNTFTJT5dwIwzQJHlJo:1RCBNTBwAHlJo
MD5 SHA1 SHA512 SSDEEP

windows x64

ComRAT v4 (Orchestrator DLL)

File contains strings specific to ComRAT v4 samples first seen in 2017.

Minor OS version

Major OS version

Entry point

376376

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CreateFileW ExpandEnvironmentStringsW IsBadStringPtrA MapViewOfFile UnmapViewOfFile SetEvent FlushViewOfFile GetCurrentProcess OpenProcess GetLocalTime SetHandleInformation ReadFile MultiByteToWideChar SetFileTime GetOEMCP GetProcAddress LoadLibraryA OpenEventW GetFileSize SetFilePointer WriteFile GetModuleHandleW LoadLibraryW GetVersionExW VirtualProtectEx GetExitCodeThread lstrcmpiW VirtualFreeEx ReadProcessMemory VirtualAllocEx GetModuleHandleA WriteProcessMemory CreateThread WideCharToMultiByte CreateDirectoryW DeleteFileW CloseHandle CreateEventW TerminateProcess Sleep CreateProcessW GetLastError GetTickCount WaitForSingleObject GetNativeSystemInfo DeleteCriticalSection EnterCriticalSection LeaveCriticalSection CreatePipe InitializeCriticalSection SetStdHandle OutputDebugStringW GetCurrentProcessId QueryPerformanceCounter GetModuleFileNameA GetSystemTimeAsFileTime GetFileAttributesExW GetStringTypeW EncodePointer DecodePointer HeapFree HeapAlloc IsDebuggerPresent IsProcessorFeaturePresent ExitProcess GetModuleHandleExW HeapReAlloc GetCPInfo GetCommandLineA GetCurrentThreadId GetStdHandle GetFileType GetModuleFileNameW WriteConsoleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetEnvironmentVariableW SetEnvironmentVariableA RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW FreeLibrary LoadLibraryExW HeapSize GetProcessHeap GetTimeZoneInformation SetFilePointerEx FlushFileBuffers GetConsoleCP GetConsoleMode IsValidCodePage GetACP GetEnvironmentStringsW FreeEnvironmentStringsW ReadConsoleW SetEndOfFile

advapi32

CryptDestroyHash CryptCreateHash CryptGenRandom CryptGetHashParam CryptDecrypt CryptDestroyKey CryptImportKey CryptReleaseContext CryptSetKeyParam CryptAcquireContextW RegSetValueExW RegCloseKey RegQueryValueExW RegCreateKeyExW CryptHashData

psapi

GetModuleBaseNameA EnumProcessModulesEx EnumProcessModules

Name

.fqmjex

Size

1003KB

Virtual Size

1003KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

470KB

Virtual Size

469KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

258KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

46KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

405KB

Virtual Size

405KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b4265be68d9ae01b3a801773891dc80b1c9501ff43a9999c3b0a0bfa3b8809a8

kernel32

advapi32

psapi